CVE-2026-4401 PUBLISHED

Download Monitor <= 5.1.10 - Cross-Site Request Forgery to Download Path Deletion and Disabling

Assigner: Wordfence
Reserved: 18.03.2026 Published: 07.04.2026 Updated: 07.04.2026

The Download Monitor plugin for WordPress is vulnerable to Cross-Site Request Forgery in the actions_handler() and bulk_actions_handler() methods in class-dlm-downloads-path.php in all versions up to, and including, 5.1.10. This is due to missing nonce verification on these functions. This makes it possible for unauthenticated attackers to delete, disable, or enable approved download paths via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
CVSS Score: 5.4

Product Status

Vendor wpchill
Product Download Monitor
Versions Default: unaffected
  • affected from 0 to 5.1.10 (incl.)

Credits

  • Kirasec finder

References

Problem Types

  • CWE-352 Cross-Site Request Forgery (CSRF) CWE